Threat Intelligence Subdomain Expert

Technology Agent Routing

When no specific platform is mentioned, provide vendor-neutral guidance.

Intelligence Types

By Consumer and Purpose

A common mistake: Treating threat intelligence as only technical IOCs. IOCs are low-fidelity, short-lived, and easy for adversaries to rotate. High-value intelligence focuses on TTPs (hard to change) and actor behavior.

IOCs vs. TTPs

Indicators of Compromise (IOCs):

• Atomic indicators: IP addresses, domain names, URLs, file hashes, email addresses
• Highly specific: Match only against known-bad infrastructure
• Short shelf-life: Attackers rotate IPs/domains frequently (hours to days)
• Low-cost for defenders to consume; low-cost for attackers to evade
• Useful for: Known threat blocking, incident timeline reconstruction

Tactics, Techniques, and Procedures (TTPs):

• Behavioral patterns: How attackers operate, not what specific infrastructure they use
• Durable: Changing TTPs requires significant re-tooling (weeks to months)
• High-cost for defenders to detect (behavioral detection); high-cost for attackers to evade
• Useful for: Detection engineering, threat hunting, red team exercises, security control assessment

The Pyramid of Pain (David Bianco):

TTP (hardest to change, most valuable)
    ↑
Tools (malware families, utilities)
    ↑
Network/Host Artifacts (registry keys, file paths, mutex names)
    ↑
Domain Names (hours-days to rotate)
    ↑
IP Addresses (trivial to change)
    ↑
Hash Values (easiest for attacker to change)

Intelligence focusing on the top of the pyramid provides more durable defensive value.

Intelligence Lifecycle

The intelligence cycle governs how raw data becomes actionable intelligence.

Six-Phase Cycle

1. Direction / Requirements

• Identify intelligence requirements: What decisions need to be supported?
• Priority Intelligence Requirements (PIRs): Top organizational questions
• Example PIRs: "Which threat actors target our industry?", "What vulnerabilities are being actively exploited against our technology stack?"

2. Collection

• Gather raw data from sources matching requirements
• Source categories:
  • OSINT (open source): Public threat reports, security blogs, VirusTotal, Shodan, social media
  • Commercial feeds: Recorded Future, Mandiant, CrowdStrike, etc.
  • ISAC/ISAO sharing: Industry-specific information sharing (FS-ISAC, H-ISAC, etc.)
  • Internal telemetry: Your own SIEM/EDR/network logs
  • Dark web: Underground forums, paste sites (requires specialized tooling)

3. Processing

• Normalize raw data into usable formats (STIX, structured records)
• Deduplicate and enrich (resolve domain to IP, look up hash reputation, identify malware family)
• Assign confidence scores and reliability assessments

4. Analysis

• Apply analytical methodologies (kill chain mapping, diamond model, ATT&CK mapping)
• Identify patterns, actor attribution, campaign tracking
• Produce analytical judgments (with confidence levels)
• Key questions: Who? What? Why? When? How? So what?

5. Dissemination

• Deliver intelligence to the right consumers in the right format
• Format by consumer: Executive briefing (PDF), analyst report (Word/HTML), machine-readable (STIX/JSON)
• TLP marking on all products
• Timeliness: Tactical TI must be delivered before the window closes

6. Feedback

• Consumers rate intelligence relevance and accuracy
• Feedback informs future collection requirements
• Close the loop: Did the intelligence lead to a successful detection or prevention?

STIX 2.1 (Structured Threat Information Expression)

STIX is the standard JSON format for representing threat intelligence.

Object Types

Domain Objects (SDOs):

Relationship Objects (SROs):

• relationship: Links two SDOs (e.g., threat-actor uses malware)
• sighting: Observation of an indicator or TTP in the wild

Cyber Observables (SCOs):

• domain-name, email-addr, file, ipv4-addr, ipv6-addr, url, windows-registry-key, network-traffic, process, user-account

STIX Example (Indicator)

{
  "type": "indicator",
  "spec_version": "2.1",
  "id": "indicator--12345678-1234-1234-1234-123456789abc",
  "created": "2024-11-01T12:00:00.000Z",
  "modified": "2024-11-01T12:00:00.000Z",
  "name": "Malicious IP - LockBit C2",
  "description": "Known LockBit 3.0 command and control server",
  "indicator_types": ["malicious-activity"],
  "pattern": "[ipv4-addr:value = '198.51.100.42']",
  "pattern_type": "stix",
  "valid_from": "2024-11-01T12:00:00.000Z",
  "valid_until": "2025-02-01T12:00:00.000Z",
  "confidence": 85,
  "labels": ["malicious-activity"],
  "object_marking_refs": ["marking-definition--amber"]
}

TAXII 2.1 (Trusted Automated eXchange of Intelligence Information)

TAXII is the transport protocol for sharing STIX objects.

API Structure

TAXII Server endpoints:

• GET /taxii2/ -- Discovery: Lists API roots
• GET /{api_root}/ -- API Root info: Collections available
• GET /{api_root}/collections/ -- List collections
• GET /{api_root}/collections/{id}/objects/ -- Get objects (with filters)
• POST /{api_root}/collections/{id}/objects/ -- Add objects (if write-enabled)
• GET /{api_root}/collections/{id}/objects/{object_id}/ -- Get specific object

Filtering (GET /objects):

• ?added_after=2024-01-01T00:00:00Z -- Objects added since timestamp
• ?type=indicator -- Filter by STIX type
• ?id=indicator--{uuid} -- Get specific object by ID
• ?match[confidence]=70,80,90,100 -- Filter by confidence score

Authentication

• HTTP Basic
• API key (Bearer token)
• OAuth 2.0 (supported by some servers)

TAXII vs. Direct API

TLP 2.0 (Traffic Light Protocol)

TLP controls information sharing. Every intelligence product should carry a TLP marking.

Marking Definitions

TLP 2.0 changes from 1.0:

• TLP:WHITE renamed to TLP:CLEAR
• TLP:AMBER+STRICT added as new level between AMBER and RED
• Explicit definition that TLP applies to the document, not individual pieces within it

Best practice: When in doubt, mark TLP:AMBER. It's better to over-protect and re-release than to under-protect sensitive intelligence.

Threat Actor Frameworks

Kill Chain (Lockheed Martin)

The Cyber Kill Chain maps the stages of a targeted attack:

1. Reconnaissance: Research on target (OSINT, scanning)
2. Weaponization: Creating malware/exploit payload
3. Delivery: Phishing email, watering hole, supply chain compromise
4. Exploitation: Vulnerability exploitation, credential theft
5. Installation: Persistence mechanism installed (registry run key, scheduled task)
6. Command & Control (C2): Establishing outbound communications to attacker infrastructure
7. Actions on Objectives: Data exfiltration, destruction, ransomware deployment

Intelligence application:

• Map collected TTPs to kill chain stages
• Identify where you have detection and prevention capabilities
• Gaps in middle stages (delivery, exploitation) are highest risk

Diamond Model

The Diamond Model represents four features of every adversary activity:

        Adversary
           /  \
          /    \
    Capability -- Infrastructure
          \    /
           \  /
          Victim

• Adversary: Threat actor (identity, motivation, intent)
• Capability: Tools, malware, exploits used
• Infrastructure: C2 servers, domains, email accounts used
• Victim: Target organization, system, user

Intelligence application:

• Any observed data point can pivot to others: Known IP (infrastructure) → reveals other domains → reveals other victims → identifies adversary
• Campaigns: Activities sharing multiple features across the diamond

MITRE ATT&CK Framework

ATT&CK is the most comprehensive TTP taxonomy used in operational threat intelligence.

Matrix structure:

• Tactics (columns): High-level objectives (Initial Access, Execution, Persistence, etc.)
• Techniques (rows): Specific methods (T1566 - Phishing, T1059 - Command and Scripting Interpreter)
• Sub-techniques: More specific variants (T1566.001 - Spearphishing Attachment)
• Mitigations: Defensive controls per technique
• Detections: Data sources and detection logic

ATT&CK usage in TI:

• Threat reports: Map actor TTPs to ATT&CK IDs for standardized description
• Detection gap analysis: Which ATT&CK techniques does your SOC have coverage for?
• Threat hunting: Generate hunting hypotheses from ATT&CK sub-techniques
• Adversary emulation: Purple team exercises using actor-attributed techniques

Threat Actor Taxonomy

Nation-State Attribution Naming

APT naming: APT = Advanced Persistent Threat. "Advanced" means capability; "Persistent" means long-dwell, targeted; "Threat" means adversary intent. Not every sophisticated attack is an APT.

Motivation Taxonomy

Reference Files

• references/concepts.md -- Deep dive on intelligence lifecycle, strategic/tactical/operational/technical levels, IOCs vs TTPs, STIX 2.1 object types and examples, TAXII 2.1 API structure, TLP 2.0 markings, kill chain, diamond model, threat actor taxonomy, and MITRE ATT&CK integration patterns.